hero image

OpenClaw proves agentic AI works. It also proves your security model doesn't. 180,000 developers just made that your problem.

by

HERO IMAGE
The open-source AI assistant OpenClaw, formerly known as Clodbot and then Moltbot, surpassed 180,000 GitHub stars and attracted 2 million visitors in a single week, according to creator Peter Steinberger.

Security researchers scanning the Internet found more than 1,800 exposed instances of leaking API keys, chat history, and account credentials. The project has been rebranded twice in recent weeks due to trademark disputes.

Agentic AI movements at the grassroots level are also the largest unmanaged attack surface that most security tools cannot see.

Enterprise security teams did not deploy this tool. Neither did their firewall, EDR, or SIEM. When agents run on BYOD hardware, the security stack goes blind. This is the difference.

Why can’t traditional perimeters see agentic AI threats?

Most enterprises treat security agentive AI as just another development tool that requires standard access controls. OpenCL proves that this assumption is architecturally wrong.

Agents work within authorized permissions, pull context from attacker-influenced sources, and execute actions autonomously. Your peripheral sees none of this. Wrong threat models means wrong controls, which means blind spots.

"AI runtime attacks are semantic rather than syntactic," Carter Rees, vice president of artificial intelligence at Reputation, told VentureBeat. "An innocuous phrase like ‘ignore previous instructions’ can carry as destructive a payload as a buffer overflow, yet it shares no resemblance with known malware signatures."

Simon Willison, software developer and AI researcher who coined the term "quick injection," describes what it says "deadly trifecta" For AI agents. These include access to private data, access to untrusted content, and the ability to communicate externally. When these three capabilities are combined, attackers can trick the agent into accessing and sending private information. Willison warns that all this can happen without even sending a single alert.

OpenClaw has all three. It reads emails and documents, pulls information from websites or shared files, and performs tasks by sending messages or triggering automated tasks. An organization’s firewall sees HTTP 200. SOC teams look at their EDR monitoring process behavior, not semantic content. The danger is semantic manipulation, not unauthorized access.

Why isn’t this limited to enthusiastic developers?

IBM Research scientists Koutar El Maghraoui and Marina Danilevsky this week analyzed OpenClaw and concluded that it challenges the hypothesis that autonomous AI agents should be vertically integrated. The device displays this "This loose, open-source layer can be incredibly powerful if it has full system access." And that’s to create agents with true autonomy. "Not limited to large enterprises" But "Can also be community driven."

This is what makes it dangerous for enterprise security. A highly capable agent without proper security controls creates major vulnerabilities in work contexts. El Magraoui emphasized that the question has shifted from whether open agentic platforms can work "What type of integration matters most, and in what context." Security questions are no longer optional.

What did the Shodan scan reveal about the exposed gateways?

Security researcher Jameson O’Reilly, founder of red-teaming company Dvulan, identified the exposed OpenClaw servers using Shodan by searching for specific HTML fingerprints. A simple search for "cloudbot control" Hundreds of results found in just a few seconds. Of the instances they examined manually, eight were completely open without any authentication. These instances gave anyone who found them full access to run commands and view configuration data.

O’Reilly received the Anthropic API keys. Telegram bot token. Slack OAuth credentials. Complete conversation history across every integrated chat platform. The two instances dropped months of private conversation as soon as the WebSocket handshake was completed. The network sees localhost traffic. Security teams have no idea what agents are calling or what data they are returning.

This is because: OpenClaw trusts localhost by default without requiring any authentication. Most deployments sit behind nginx or Caddy as a reverse proxy, so each connection looks like it’s coming from 127.0.0.1 and is treated as trusted local traffic. External requests come directly. O’Reilly’s specific attack vector has been patched, but the architecture that allowed it has not changed.

Why Cisco calls it a ‘security nightmare’

Cisco’s AI Threat and Security Research team published its assessment this week, calling OpenClaw "unprecedented" But from a capacity perspective "an absolute nightmare" From security point of view.

The Cisco team released an open-source skills scanner that combines static analysis, behavioral dataflow, LLM semantic analysis, and VirusTotal scanning to detect malicious agent skills. It tested third-party skills called "What will Elon do?" Against OpenCL. The decision was a decisive failure. Nine security findings were made, including two critical and five high-severity issues.

The skill was functionally malware. This instructed the bot to execute curl commands by sending data to an external server controlled by the skill author. Silent execution, zero user awareness. Kaushal also deployed direct quick injection to bypass security guidelines.

"LLM cannot inherently distinguish between reliable user instructions and untrusted retrieved data," Reece said. "It can execute embedded commands, effectively becoming a ‘confused deputy’ acting on behalf of the attacker." AI agents with system access become covert data-leak channels that bypass traditional DLP, proxy, and endpoint monitoring.

Why did the visibility of security teams become worse?

The control gap is growing faster than most security teams anticipate. As of Friday, OpenGL-based agents are building their own social networks. Communication channels that exist completely outside human visibility.

Moltbuk presents itself as "A social network for AI agents" Where? "Humans are welcome to observe." Posts go through the API, not through a human-view interface. Scott Alexander of Astral Codex Ten confirmed that this is no small matter. He asked his own cloud to participate, and "It drew the same comments as all the others." A human confirmed that their agent has started a religion-based community "While I slept."

The security implications are immediate. To join, agents execute external shell scripts that rewrite their configuration files. They post about their work, their users’ habits, and their errors. Context leakage as table stakes for participation. Any quick injection into Moltbuk post cascades to other capabilities of your agent through the MCP connection.

Moltbuk is a microcosm of the broader problem. The same autonomy that makes agents useful also makes them vulnerable. The more they can do independently, the more damage a compromised instruction set can do. The capacity curve is outpacing the safety curve by a wide margin. And the people building these tools are often more excited about what’s possible than worried about what’s exploitable.

What security leaders need to do on Monday morning

Web application firewall agents treat the traffic as normal HTTPS. EDR tools monitor process behavior, not semantic content. A typical corporate network sees localhost traffic when agents call the MCP server.

"Treat agents as production infrastructure, not productivity apps: least privileges, scoped tokens, allowed listed actions, strong authentication on every integration, and auditability end-to-end," Itamar Golan, founder of Prompt Security (now part of SentinelOne), told VentureBeat in an exclusive interview.

Audit your network for exposed agentic AI gateways. Run a Shodan scan against your IP range for OpenClaw, Moltbot, and Clawdbot signatures. If your developers are experimenting, you’ll want to know before attackers do.

Map where Willison’s deadly trifecta is present in your environment. Identify systems that combine private data access, untrusted content exposure, and external communications. Assume that any agent with these three is unsafe until proven otherwise.

Aggressively segment access. Your agent doesn’t need access to all of Gmail, all of SharePoint, all of Slack, and all of your databases at once. Treat agents as privileged users. Log not only the user’s authentication, but also the agent’s activities.

Scan your agent skills for malicious behavior. Cisco released its Skill Scanner as open source. use it. Some of the most harmful behavior hides within files.

Update your incident response playbook. Prompt injection does not look like a traditional attack. There is no malware signature, no network anomaly, no unauthorized access. The attack occurs inside the logic of the model. Your SOC needs to know what to look for.

Establish a policy before imposing restrictions. You can’t prohibit experimentation without becoming a productivity barrier for your developers. Build guardrails that channel rather than block innovation. Shadow AI is already in your environment. The question is whether you have visibility into it.

bottom line

OpenClaw is not a threat. This is a sign. The security flaws these examples highlight will plague every agent AI deployment your organization creates or adopts over the next two years. The experiment has already taken place at the ground level. Control intervals are documented. Attack patterns are published.

Over the next 30 days, the agentic AI security model you build determines whether your organization achieves productivity gains or becomes the next breach disclosure. Verify your controls now.



<a href

77 thoughts on “OpenClaw proves agentic AI works. It also proves your security model doesn't. 180,000 developers just made that your problem.”

  2. https://miamifightcard.com/
    When it comes to MediaFightCard, the gambling markets reveal a compelling dynamic with titleholders entering as underdogs and opponents occupying favorite status. In the featured bout for the available light heavyweight title, previous belt-holder Jiri Prochazka opened as a marginal favorite at -143 over the surging Carlos Ulberg, who enters as a +116 underdog even with his nine-fight winning streak.

    Reply

  3. https://sportium.net.co/
    A plataforma Sportium Colombia e um casino e uma casa de apostas esportivas pela internet que funciona com plena legalidade amparado pela licenca da Coljuegos, resultado da alianca entre CIRSA e Ladbrokes desde 2007. Disponibiliza uma estrutura confiavel e abrangente onde os usuarios da Colombia tem acesso desde apostas ao futebol ate slots e cassino em tempo real com atendentes reais, tudo no mesmo site.

    Reply

  4. https://888starz.net.co/
    888Starz Colombia representa una plataforma de casino online y casa de apuestas que cuenta con mas de 9.500 juegos disponibles, entre los que se incluyen tragamonedas en linea, mesas con crupier en vivo junto a una variada seleccion de disciplinas deportivas que cubre desde la Liga BetPlay hasta la UEFA Champions League y las competiciones de esports.

    Reply

  5. https://ufc327odds.com/
    The upcoming UFC 327 light heavyweight championship bout in Miami offers a genuine pick’em for the gambling public, as former titleholder Jiri Prochazka (-142) and on-a-roll knockout specialist Carlos Ulberg (+120) prepare to square off for the open belt. The razor-thin odds underscore how comparable these two striking specialists really are, setting up a matchup where a wager on either man ultimately comes down to which dynamic skillset you believe will reign supreme.

    Reply

  9. https://betway-bet.com.mx/
    Betway para Mexico constituye un casino en linea y plataforma de pronosticos deportivos con cerca de dos decadas de trayectoria global, amparado bajo habilitaciones de organismos exigentes por ejemplo la Malta Gaming Authority junto con la Comision de Juego del Reino Unido, y opera ateniendose a la normativa de SEGOB dentro del territorio mexicano.

    Reply

  10. https://lebull.com.mx/
    Segun la informacion suministrada, nos encontramos con que Lebull es un casino online y plataforma de apuestas deportivas que funciona en el mercado mexicano contando con una coleccion de mas de 10,000 juegos, una mobile app con todas las prestaciones y companias lideres como Pragmatic Play, NetEnt y NolimitCity.

    Reply

  11. Khamzat Chimaev seems impossible to beat, though Sean Strickland’s combination of weirdness and resilience that he has the potential to shock everyone, whereas the other bouts on the card showcase a stand-up fighter against a submission expert with no losses at 125 pounds, two heavyweight knockout artists with granite chins, a chess match fought with fists at welterweight, plus a classic, nostalgia-fueled donnybrook between veteran lightweights, where each matchup is constructed so that someone’s flawless strategy could unravel.

    Reply

  12. What the text boils down to suggests that UFC 328 on May 9 features five must-see bouts across five weight classes, including Khamzat Chimaev favored but with no guarantee past the durable and awkward Sean Strickland for the middleweight title, whereas the bouts at flyweight, heavyweight, welterweight, and lightweight all offer hazardous confrontations of fighting styles which guarantee the night will not be uneventful.

    Reply

  13. The unbeaten Khamzat Chimaev will beat the former champion Sean Strickland via judges’ scorecards following wrestling becoming the deciding factor from the middle frames onward, and the rest of the event features Van securing a slim decision over Taira, a late TKO finish for Volkov, Buckley getting a stoppage victory, and Green winning by judges’ decision.

    Reply

  14. https://differ.blog/p/ufc-328-predictions-who-wins-who-gets-exposed-and-one-fight-that-co-482b16
    The prediction is that Khamzat Chimaev will defeat Sean Strickland via decision in a tough, back-and-forth fight, while the remainder of the UFC 328 card features several near calls, such as Van defending his title against Taira, Volkov winning by a stoppage in the later rounds, Buckley surprising Brady on the scorecards or by stoppage, and Green squeezing out a points victory over Stephens.

    Reply

  16. The leading provider of the most recent fighting world reports, match results, top-fighter lists, and premium internal news from the MMA universe.

    Reply

  18. https://saffa-luck.co.za/
    The Saffa Luck platform comes across as a modern online casino along with sportsbook built uniquely for the South African market, that carries out its activity with a valid permit in place and makes available an all-round proposition whether through a smartphone as well as through the laptop.

    Reply

  21. UFC 328 touches down at the Prudential Center on May 9, 2026 featuring a strong lineup. The UFC 328 main card is led by champion Khamzat Chimaev defending the middleweight title against Sean Strickland.

    Reply

  29. https://888starz.com.mx/
    La plataforma 888Starz es un moderno casa de apuestas online y centro de apuestas deportivas desarrollado especialmente para la audiencia de Mexico, que realiza sus actividades de forma legal y proporciona una propuesta integral tanto desde el celular como desde la computadora.

    Reply

  35. This coming Saturday, that proximity will weigh most heavily by Florim Zendeli, a fighter assigned to step into a hornet’s nest to battle the local favorite, Logan Storley.

    Reply

  43. ACA 203 touches down in Tashkent with a crucial flyweight headline bout and a lineup that capitalizes strongly on the promotion’s regional strength in Uzbekistan .

    Reply

  48. http://convexa.es/
    La empresa Convexa se presenta como una consultora con experiencia con presencia en el tejido empresarial espanol, que proporciona servicios de calidad a quienes buscan resultados, priorizando en la confianza y la transparencia. Mas informacion aqui.

    Reply

  50. http://digital-moon.es/
    Digital Moon se consolida como una consultora con experiencia orientada al tejido empresarial espanol, que pone a disposicion un acompanamiento profesional a quienes buscan resultados, priorizando en la confianza y la transparencia. Descubre todos los detalles a traves del enlace.

    Reply

  53. Inside Tashkent’s Humo Arena this May, the atmosphere won’t only be charged by the din of loyal local fans ; instead, it will be burdened by the career survival of fighters who’ve devoted their lives to chasing glory .
    ACA 203 is far from merely another date on the regional circuit ; it marks a critical crossroads for all involved.

    Reply

  59. When you examine the deeper numbers on GidStats you’ll notice Medkouri operates with far greater striking efficiency and doesn’t fade as soon as wrestling comes into play .
    Neves arrives carrying all the “heavy hitter” buzz.

    Reply

  60. This Friday, May 8, UAE Warriors 70 rolls into the Space42 Arena in Abu Dhabi presenting an event dense with regional experts and veteran international fighters chasing a final launchpad to major organizations .

    Reply

Leave a Comment